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DETAILED ACTION 

Continued Examination Under 37 CFR 1.114 

1 . A request for continued examination under 37 CFR 1.114, including the fee set forth in 
37 CFR 1.17(e), was filed in this application after final rejection. Since this application is 
eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1 . 1 7(e) 
has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 
37 CFR 1.1 14. Applicant's submission filed on 18-July-2005 has been entered. 

Remarks 

2. In response to communications filed on 18-July-2005 claims 1-50 are presently pending 
in the application. The declaration under 37 C.F. R. section 1.132 has been considered and not 
found persuasive. The examiners response to the declaration and to the attorney's arguments are 
addressed in the "Response to Arguments" section of this action. 

Claim Rejections - 35 USC §103 

3. The following is a quotation of 35 U.S. C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be. negatived by the 
manner in which the invention was made. 

4. Claims 1, 6, 8-9, 15, 20, 22-23, 29, 33, 35, 40, 44, and 46 are rejected under 35 U.S.C. 
103(a) as being unpatentable over Anderl et al. (International Publication No. 87/07062) in view 



of Smith (U.S. patent No. 4,9563,769). 
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As to claim 1, Anderl et al. teaches a portable security system for managing access to a 
portable data storage cartridge, the data storage cartridge having data storage media for storing 
data for read/write access by a user of a data storage drive when mounted in the data storage 
drive (see abstract), the portable security system comprising: 

a wireless interface mounted in the portable data storage cartridge for receiving power 
and data from, and sending data to, the data storage drive when mounted in the data storage drive 
(see page 5, line 31 through page 6, line 23); and 

a computer processor mounted in the portable data storage cartridge and coupled to the 
wireless interface (see figure 1, reference numbers 110, 120, and 130); the computer processor 
powered by the wireless interface and receiving and transmitting data to the data storage drive 
via the wireless interface (see page 5, line 3 1 through page 6, line 23); the computer processor 
receiving the user authentication messages from the data storage drive via the wireless interface, 
and transmitting the user authorization or denial to the data storage drive via the wireless 
interface (see page 10, lines 19-26). 

Anderl et al. does not teach the computer processor having a user table comprising at 
least a unique user identifier for each authorized user and at least one permitted activity the user 
is authorized to conduct with respect to the data storage media, the user identifier, when 
combined with a user authentication message from the authorized user in accordance with a 
predetermined algorithm, authorizes the user; and combining the user authentication message 
with at least part of the user identifier from the user table in accordance with the predetermined 
algorithm to authorize or deny the user activity. 
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Smith teaches a security system for computer databases (see abstract), in which he 
teaches the computer processor having a user table comprising at least a unique user identifier 
for each authorized user and at least one permitted activity the user is authorized to conduct with 
respect to the data storage media (see column 2, lines 11-17), the user identifier, when combined 
with a user authentication message from the authorized user in accordance with a predetermined 
algorithm, authorizes the user (see column 5, lines 9-14 and see figure 1); and combining the 
user authentication message with at least part of the user identifier from the user table in 
accordance with the predetermined algorithm to authorize or deny the user activity (see column 
5, lines 9-14 and see figure 1). 

It would have been obvious to a person having ordinary skill in the art at the time the 
invention was made to have modified Anderl et al. by the teachings of Smith because the 
computer processor having a user table comprising at least a unique user identifier for each 
authorized user and at least one permitted activity the user is authorized to conduct with respect 
to the data storage media, the user identifier, when combined with a user authentication message 
from the authorized user in accordance with a predetermined algorithm, authorizes the user; and 
combining the user authentication message with at least part of the user identifier from the user 
table in accordance with the predetermined algorithm to authorize or deny the user activity 
would limit the access of selected users to pre-selected locations which they are authorized to 
access (see Smith , column 1, lines 7-12). 
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As to claim 15, Anderl et al. teaches a data storage cartridge for storing data for 
read/write access by a user of a data storage drive when mounted in the data storage drive (see 
abstract), comprising: 

data storage media mounted in the data storage cartridge for storing the data for the 
read/write access (see figure 1, reference number 115); a wireless interface mounted in the 
portable data storage cartridge for receiving power and data from, and sending data to, the data 
storage drive when mounted in the data storage drive (see page 5, line 3 1 through page 6, line 
23); and 

a computer processor mounted in the portable data storage cartridge and coupled to the 
wireless interface (see figure 1, reference numbers 1 10, 120, and 130); the computer processor 
powered by the wireless interface and receiving and transmitting data to the data storage drive 
via the wireless interface (see page 5, line 3 1 through page 6, line 23); the computer processor 
receiving the user authentication messages from the data storage drive via the wireless interface, 
and transmitting the user authorization or denial to the data storage drive via the wireless 
interface (see page 10, lines 19-26). 

Anderl et al. does not teach the computer processor having a user table comprising at 
least a unique user identifier for each authorized user and at least one permitted activity the user 
is authorized to conduct with respect to the data storage media, the user identifier, when 
combined with a user authentication message from the authorized user in accordance with a 
predetermined algorithm, authorizes the user; and combining the user authentication message 
with at least part of the user identifier from the user table in accordance with the predetermined 
algorithm to authorize or deny the user activity. 
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Smith teaches the computer processor having a user table comprising at least a unique 
user identifier for each authorized user and at least one permitted activity the user is authorized 
to conduct with respect to the data storage media (see column 2, lines 11-17), the user identifier, 
when combined with a user authentication message from the authorized user in accordance with 
a predetermined algorithm, authorizes the user (see column 5, lines 9-14 and see figure 1); and 
combining the user authentication message with at least part of the user identifier from the user 
table in accordance with the predetermined algorithm to authorize or deny the user activity (see 
column 5, lines 9-14 and see figure 1). 

It would have been obvious to a person having ordinary skill in the art at the time the 
invention was made to have modified Anderl et al. by the teachings of Smith because the 
computer processor having a user table comprising at least a unique user identifier for each 
authorized user and at least one permitted activity the user is authorized to conduct with respect 
to the data storage media, the user identifier, when combined with a user authentication message 
from the authorized user in accordance with a predetermined algorithm, authorizes the user; and 
combining the user authentication message with at least part of the user identifier from the user 
table in accordance with the predetermined algorithm to authorize or deny the user activity 
would limit the access of selected users to pre-selected locations which they are authorized to 
access (see Smith , column 1, lines 7-12). 

As to claim 29, Anderl et al. teaches a method for providing a portable secure interface to 
a data storage cartridge (see abstract, where it is inherent that "a method for providing a portable 
secure interface to a data storage cartridge" is disclosed in "a portable data carrier system" that 
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does not provide information of particular applications or file structure to its users), the data 
storage cartridge having data storage media for storing data for read/write access by a user of a 
data storage drive when mounted in the data storage drive (see figure 1, reference number 1.15), 
and a wireless interface mounted in the portable data storage cartridge for receiving power and 
data from, and sending data to, the data storage drive when mounted in the data storage drive 
(see page 5, line 3 1 through page 6, line 23), the method comprising the steps of: 

receiving the user authentication messages from the data storage drive via the wireless 
interface; and transmitting the user authorization or denial to the data storage drive via the 
wireless interface (see page 10, lines 19-26). 

Anderl et al. does not teach the data storage cartridge having a user table comprising at 
least a unique user identifier for each authorized user and at least one permitted activity the user 
is authorized to conduct with respect to the data storage media, the user identifier, when 
combined with a user authentication message from the authorized user in accordance with a 
predetermined algorithm, authorizes the user; and combining the user authentication message 
with at least part of the user identifier from the user table in accordance with the predetermined 
algorithm to authorize or deny the user activity. 

Smith teaches the data storage cartridge having a user table comprising at least a unique 
user identifier for each authorized user and at least .one permitted activity the user is authorized 
to conduct with respect to the data storage media (see column 2, lines 11-17), the user identifier, 
when combined with a user authentication message from the authorized user in accordance with 
a predetermined algorithm, authorizes the user (see column 5, lines 9-14 and see figure 1); and 
combining the user authentication message with at least part of the user identifier from the user 
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table in accordance with the predetermined algorithm to authorize or deny the user activity (see 
column 5, lines 9-14 and see figure 1). 

It would have been obvious to a person having ordinary skill in the art at the time the 
invention was made to have modified Anderl et al. by the teachings of Smith because the data 
storage cartridge having a user table comprising at least a unique user identifier for each 
authorized user and at least one permitted activity the user is authorized to conduct with respect 
to the data storage media, the user identifier, when combined with a user authentication message 
from the authorized user in accordance with a predetermined algorithm, authorizes the user; and 
combining the user authentication message with at least part of the user identifier from the user 
table in accordance with the predetermined algorithm to authorize or deny the user activity 
would limit the access of selected users to pre-selected locations which they are authorized to 
access (see Smith , column 1, lines 7-12). 

As to claim 40, Anderl et al. teaches a computer program product usable with a 
programmable Computer processor having computer readable program code embodied therein 
for providing a secure interface to a data storage cartridge (see abstract), the programmable 
computer processor mounted in the data storage cartridge (see figure 1, reference number 1 10), 
the data storage cartridge having data storage media for storing data for read/write access by a 
user of a data storage drive when mounted in the data storage drive (see figure 1, reference 
number 115), and a wireless interface mounted in the portable data storage cartridge for 
receiving power and data from, and sending data to, the data storage drive when mounted in the 
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data storage drive (see page 5, line 3 1 through page 6, line 23) , the computer program product 
comprising: 

computer readable program code which causes the programmable computer processor to 
receive the user authentication messages from the data storage drive via the wireless interface; 
and computer readable program code which causes the programmable computer processor to 
transmit the user authorization or denial to the data storage drive via the wireless interface (see 
page 10, lines 19-26). 

Anderl et al. does not teach computer readable program code which causes the 
programmable computer processor to provide a user table comprising at least a unique user 
identifier for each authorized user and at least one permitted activity the user is authorized to 
conduct with respect to the data storage media, the user identifier, when combined with a user 
authentication message from the authorized user in accordance with a predetermined algorithm, 
authorizes the user; and combine the user authentication message with at least part of the user 
identifier from the user table in accordance with the predetermined algorithm to authorize or 
deny the user activity. 

Smith teaches computer readable program code which causes the programmable 
computer processor to provide a user table comprising at least a unique user identifier for each 
authorized user and at least one permitted activity the user is authorized to conduct with respect 
to the data storage media (see column 2, lines 11-17), the user identifier, when combined with a 
user authentication message from the authorized user in accordance with a predetermined 
algorithm, authorizes the user (see column 5, lines 9-14 and see figure 1); and computer readable 
program code which causes the programmable computer processor to combine the user 
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authentication message with at least part of the user identifier from the user table in accordance 
with the predetermined algorithm to authorize or deny the user activity (see column 5, lines 9-14 
and see figure 1). 

It would have been obvious to a person having ordinary skill in the art at the time the 
invention was made to have modified Anderl et al. by the teachings of Smith because computer 
readable program code which causes the programmable computer processor to provide a user 
table comprising at least a unique user identifier for each authorized user and at least one 
permitted activity the user is authorized to conduct with respect to the data storage media, the 
user identifier, when combined with a user authentication message from the authorized user in 
accordance with a predetermined algorithm, authorizes the user; and computer readable program 
code which causes the programmable computer processor to combine the user authentication 
message with at least part of the user identifier from the user table in accordance with the 
predetermined algorithm to authorize or deny the user activity would limit the access of selected 
users to pre-selected locations which they are authorized to access (see Smith , column 1, lines 7- 
12). 

As to claims 6, 20, and 44, Anderl et al. as modified, teaches wherein the computer 
processor user table permitted activities comprise a plurality of permitted activities, selected ones 
of which each of the users may be authorized to conduct, the permitted activities comprising 1) 
read access to data stored in the data storage media, 2) write access to data stored in the data 
storage media (see Smith , column 4, lines 59-66), 3) read the user entry of the user table, 4) read 
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all entries of the user table, 5) add entries to the user table, and 6) change/delete entries to the 
user table (see Smith , column 3, line 62 through column 4, line 14). 

As to claims 8, 22, and 46, Anderl et al. as modified, teaches wherein the computer 
processor user table comprises a separate entry for each the user identifier, the entry comprising 
all the permitted activities the user is authorized to conduct (see Smith , column 2, lines 11-17). 

As to claims 9 and 23, Anderl et al. as modified, teaches wherein the computer processor 
additionally comprises a nonvolatile memory storing the user table (see Anderl et al. . page 11, 
lines 21-26). 

As to claim 33, Anderl et al. as modified, teaches wherein the user table comprises a 
plurality of the permitted activities, selected ones of which each of the users may be authorized 
to conduct, the permitted activities comprising 1) read access to data stored in the data storage 
media, 2) write access to data stored in the data storage media (see Smith column 4, lines 59-66), 
3) read the user entry of the user table, 4) read all entries of the user table, 5) add entries to the 
user table, and 6) change/delete entries to the user table; and wherein the transmitting step 
comprises transmitting authorization to conduct the selected the user permitted activities the user 
is authorized to conduct (see Smith , column 3, line 62 through column 4, line 14). 



As to claim 35, Anderl et al. as modified, teaches wherein the step of providing the user 
table comprises a separate entry for each the user identifier, the entry comprising all the 
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permitted activities the user is authorized to conduct; and wherein the transmitting step 
additionally comprises identifying the user permitted activities from the user separate entry (see 
Smith , column 2, lines 11-17). 

1. Claims 2 and 16 are rejected under 35 U.S.C. 103(a) as being unpatentable over Anderl et 
al (International Publication No. 87/07062) in view of Smith (U.S. patent No. 4,9563,769) as 
applied to claims 1, 6, 8-9, 15, 20, 22-23, 29, 33, 35, 40, 44, and 46 above, and further in view of 
Davis (U.S. patent No. 4,941,201). 

As to claims 2 and 16, Anderl et al. as modified, does not teach wherein the wireless 
interface comprises an RF interface. 

Davis teaches an electronic data storage apparatus (see abstract), in which he teaches 
wherein the wireless interface comprises an RF interface (see column 5, lines 55-61 and see 
column 21, lines 3 1-46, where 100 kHz is in the RF range of the Electromagnetic Spectrum). 

It would have been obvious to a person having ordinary skill in the art at the time the 
invention was made to have modified Anderl et al. as modified, by the teachings of Davis 
because wherein the wireless interface comprises an RF interface would make the propagation 
delay between the outputs of the inverters 5 microseconds (see Davis , column 21, lines 39-46). 



2. Claims 3-5, 17-19, 30-31, and 41-43 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Anderl et al. (International Publication No. 87/07062) in view of Smith (U.S. 
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patent No. 4,9563,769) as applied to claims 1, 6, 8-9, 15, 20, 22-23, 29, 33, 35, 40, 44, and 46 
above, and further in view of Wright et al. (U.S. patent No. 6,084,969). 

As to claims 3, 17, 30, and 41, Anderl et al. as modified, does not teach wherein each the 
user identifier comprises a user symbol and a user decrypting key, wherein the user 
authentication message comprises an encrypted user authentication message which may be 
decrypted by the user decrypting key, and wherein the computer processor conducts the 
combination by decrypting the user authentication message by the user decrypting key. 

Wright et al. teaches an encryption system for a two way pager (see abstract), in which he 
teaches wherein each the user identifier comprises a user symbol and a user decrypting key (see 
column 11, line 65 through column 12, line 5), wherein the user authentication message 
comprises an encrypted user authentication message which may be decrypted by the user 
decrypting key, and wherein the computer processor conducts the combination by decrypting the 
user authentication message by the user decrypting key (see column 12, lines 5-13). 

It would have been obvious to a person having ordinary skill in the art at the time the 
invention was made to have modified Anderl et al. as modified, by the teachings of Wright et al. 
because wherein each the user identifier comprises a user symbol and a user decrypting key, 
wherein the user authentication message comprises an encrypted user authentication message 
which may be decrypted by the user decrypting key, and wherein the computer processor 
conducts the combination by decrypting the user authentication message by the user decrypting 
key would authenticate the sender and protect the contents of the message (see Wright et al. , 
column 9, lines 51-56). 
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As to claims 4, 18, 3 1, and 42, Anderl et al. as modified, teaches wherein the user 
decrypting key comprises a sender public key, and wherein the predetermined algorithm 
comprises a public key cryptographic algorithm (see Wright et al. , column 12, lines 5-13). 

As to claims 5 and 19, Anderl et al. as modified, teaches wherein the user authentication 
message is encrypted by a sender private key and a receiver public key (see Wright et al. , column 
9, lines 51-56), and wherein the public key cryptographic algorithm decrypts the user 
authentication message employing a receiver private key and the sender public key, whereby the 
user authentication message is known to have come from the user (see Wright et al. , column 12, 
lines 5-13). 

As to claims 32 and 43, Anderl et al. as modified, teaches wherein the user authentication 
message is encrypted by a sender private key and a receiver public key (see Wright et al. , column 
9, lines 51-56), wherein the public key cryptographic algorithm decrypts the user authentication 
message employing a receiver private key and the sender public key, and wherein the combining 
step comprises decrypting the user authentication message by the receiver private key and the 
sender public key, whereby the user authentication message is known to have come from the user 
(see Wright et al. , column 12, lines 5-13). 



3. Claims 7, 10-13, 21, 24-27, 34, 36-38, 45, and 47-49 rejected under 35 U.S.C. 103(a) as 
being unpatentable over Anderl et al (International Publication No. 87/07062) in view of Smith 
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(U.S. patent No. 4,9563,769) as applied to claims 1, 6, 8-9, 15, 20, 22-23, 29, 33, 35, 40, 44, and 
46 above, and further in view of Bapat et al. (U.S. patent No. 6,038,563). 

As to claims 7, 21, and 45, Anderl et al. as modified, does not teach wherein the 
computer processor user table comprises a separate entry for each the user identifier and the 
permitted activity the user is authorized to conduct. 

Bapat et al. teaches access control to a database using a permissions table (see abstract), 
in which he teaches wherein the computer processor user table comprises a separate entry for 
each the user identifier and the permitted activity the user is authorized to conduct. 

It would have been obvious to a person having ordinary skill in the art at the time the 
invention was made to have modified Anderl et al. as modified, by the teachings of Bapat et al. 
because wherein the computer processor user table comprises a separate entry for each the user 
identifier and the permitted activity the user is authorized to conduct would give a way to grant 
or deny access to certain users (see Bapat et al. , column 11, lines 4-7). 

As to claims 10, 24, 36, and 47, Anderl et al. as modified, teaches receiving the user 
authentication messages from the data storage drive via the wireless interface, and transmitting 
the class authorization or denial to the data storage drive via the wireless interface (see Anderl et 
aL page 12, lines 7-15, and see figure 7). 

Anderl et al. as modified, does not teach wherein the computer processor additionally 
comprises a class table comprising at least a unique class identifier for each authorized class of 
users and at least one permitted activity the class of users is authorized to conduct with respect to 
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the data storage media, the class identifier, when combined with a user authentication message 
from a user of the authorized class of users in accordance with the predetermined algorithm, 
authorizes the user; and wherein the computer processor additionally, upon receiving the user 
authentication messages, combining the user authentication message with the class identifier 
from the class table in accordance with the predetermined algorithm to authorize or deny the 
class activity to the user, and transmitting the class authorization or denial. 

Bapat et al. teaches wherein the computer processor additionally comprises a class table 
comprising at least a unique class identifier for each authorized class of users and at least one 
permitted activity the class of users is authorized to conduct with respect to the data storage 
media, the class identifier (see column 10, lines 35-47), when combined with a user 
authentication message from a user of the authorized class of users in accordance with the 
predetermined algorithm, authorizes the user (see figure 5); and wherein the computer processor 
additionally, upon receiving the user authentication messages, combining the user authentication 
message with the class identifier from the class table in accordance with the predetermined 
algorithm to authorize or deny the class activity to the user, and transmitting the class 
authorization or denial (see figure 6). 

It would have been obvious to a person having ordinary skill in the art at the time the 
invention was made to have modified Anderl et al. as modified, by the teachings of Bapat et al. 
because wherein the computer processor additionally comprises a class table comprising at least 
a unique class identifier for each authorized class of users and at least one permitted activity the 
class of users is authorized to conduct with respect to the data storage media, the class identifier, 
when combined with a user authentication message from a user of the authorized class of users in 
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accordance with the predetermined algorithm, authorizes the user; and wherein the computer 
processor additionally, upon receiving the user authentication messages, combining the user 
authentication message with the class identifier from the class table in accordance with the 
predetermined algorithm to authorize or deny the class activity to the user, and transmitting the 
class authorization or denial would make an easy way to define a set of access rules to grant 
access rights to a broad group of users (see Bapat et aL column 11, lines 56-59) and would help 
to reduce the amount of data required to define access rules (see Bapat et aL column 9, lines 48- 
50). 

As to claims 1 1, 25, 37, and 48, Anderl et al. as modified, teaches wherein the computer 
processor user table additionally comprises any class membership of each the user (see Bapat et 
aL, Column 10, lines 4-10), wherein the user may be authorized with respect to the class table 
either by the class authorization or by the user authorization (see Bapat et al. , figure 15 A). 

As to claims 12, 26, and 49, Anderl et al. as modified, teaches wherein the computer 
processor user table and the class table permitted activities comprise a plurality of permitted 
activities, selected ones of which each of the users may be authorized to conduct, the permitted 
activities comprising 1) read access to data stored in the data storage media, 2) write access to 
data stored in the data storage media, 3) read all entries of the class table, 4) add entries to the 
class table, and 5) change/delete entries to the class table (see Bapat et al. , column 10, lines 35- 
47). 
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As to claims 13 and 27, Anderl et al. as modified, teaches wherein the computer 
processor additionally comprises a 'nonvolatile memory storing the user table (see Anderl et al. . 
page 11, lines 14-26) and the class table (see Bapat et al. , column 7, lines 18-24). 

As to claim 34, Anderl et al. as modified, does not teach wherein the user table comprises 
a separate entry for each the user identifier and the permitted activity the user is authorized to 
conduct; and wherein the transmitting step additionally comprises identifying the user permitted 
activities from the separate entries. 

Bapat et al. teaches wherein the user table comprises a separate entry for each the user 
identifier and the permitted activity the user is authorized to conduct; and wherein the 
transmitting step additionally comprises identifying the user permitted activities from the 
separate entries (see column 10, lines 35-47). 

It would have been obvious to a person having ordinary skill in the art at the time the 
invention was made to have modified Anderl et al as modified, by the teachings of Bapat et al. 
because wherein the user table comprises a separate entry for each the user identifier and the 
permitted activity the user is authorized to conduct; and wherein the transmitting step 
additionally comprises identifying the user permitted activities from the separate entries would 
give a way to grant or deny access to certain users (see Bapat et al. , column 1 1, lines 4-7). 

As to claim 38, Anderl et al. as modified, teaches wherein the user table and the class 
table comprise a plurality of permitted activities, selected ones of which each of the users may be 
authorized to conduct, the permitted activities comprising 1) read access to data stored in the data 
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storage media, 2) write access to data stored in the data storage media, 3) read all entries of the 
class table, 4) add entries to the class table, and 5) change/delete entries to the class table; and 
wherein the transmitting step comprises transmitting authorization to conduct the selected the 
user and the class permitted activities the user is authorized to conduct (see Bapat et aL column 
10, lines 35-47). 

4. Claims 14, 28, 39, and 50 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Anderl et al. (International Publication No. 87/07062) in view of Smith (U.S. patent No. 
4,9563,769) as applied to claims 1, 6, 8-9, 15, 20, 22-23, 29, 33, 35, 40, 44, and 46 above, and 
further in view of Hastings et al. (U.S. patent No. 6,370,629 Bl). 

As to claims 14, 28, 39, and 50 Anderl et al. as modified, teaches wherein the computer 
processor user table permitted activities comprise at least 1) read access to data stored in the data 
storage media (see Smith , column 4, lines 59-66). 

Anderl et al. as modified, does not teach wherein the data stored in the data storage media 
is encrypted, and wherein the user authorization for the read access additionally comprises a 
decryption key for the encrypted stored data. 

Hastings et al. teaches giving access to information based on time and geographic 
position (see abstract), in which he teaches wherein the data stored in the data storage media is 
encrypted (see column 3, line 63 through column 4, line 4), and wherein the user authorization 
for the read access additionally comprises a decryption key for the encrypted stored data (see 
column 5, lines 52-61). 
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It would have been obvious to a person having ordinary skill in the art at the time the 
invention was made to have modified Anderl et al. as modified, by the teachings of Hastings et 
al because wherein the data stored in the data storage media is encrypted, and wherein the user 
authorization for the read access additionally comprises a decryption key for the encrypted stored 
data would keep an unauthorized user from accessing the files (see Hastings et al. , column 5, 
lines 52-61). 

Response to Arguments 
5. Applicant's arguments filed on 18-July-2005 with respect to rejected claims have been 
considered but are not deemed persuasive. 

In response to the arguments that "Any authentication (not directly described) appears to 
be of the 'card' or 'file' and not the 'user'", the arguments have been fully considered but are not 
deemed persuasive. The user of Anderl et al. is being authenticated to access the "card" or 
"file". The user is not performing the authentication process in order to be sure that the card is 
the correct card, but to be sure that the user is authorized to access that card as in the present 
application. As admitted in the above rejection under 35 U.S.C. § 103(a), Anderl et al. does not 
appear to teach the computer processor having a user table comprising at least a unique user 
identifier for each authorized user and at least one permitted activity the user is authorized to 
conduct with respect to the data storage media, which is why the examiner relies on Smith to 
teach this limitation. The applicant is reminded that one cannot show nonobviousness by 
attacking references individually where the rejections are based on combinations of references. 
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See In re Keller, 642 F.2d 413, 208 USPQ 871 (CCPA 1981); In re Merck & Co,, 800 F.2d 1091, 
231 USPQ 375 (Fed. Cir. 1986). 

ih&; .^^^d4!l^! . B^^l^i'lfsii^ ^^wp}^^'^ 

the '.'password^ of Anderfet a£ instead of the "user natrie*' or -Siser symbol*' one might nprmally 
intejrjpret a "usetidenltfi^r^ 1 to b;e; With that stated it is tioted.that:the;examiner acknowledged in 
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In response to the arguments that "Anderl et al. appears to fail to provide a truly portable 
security access system" because "management is limited to a particular station", the arguments 
have been fully considered but are not deemed persuasive. Anderl et al. teaches "a system for a 
portable data carrier" (see title). Access to the system is given based on the password provided 
by the user (see page 9, lines 4-9). Nowhere does Anderl et al discuss specially required 
hardware that only the "MASTER USER", "DEVELOPER", or "SUPER USER" has access to, 
but rather specially required passwords to access these levels. After looking at the entire 
disclosure of Anderl et al. , one would assume that the "appropriate application station" would be 
any station that the user normally uses that includes the appropriate hardware for reading from 
and writing to the card. These stations may most commonly be at the development site or 
factory where the card is designed and produced because that is wehre the "MASTER USER", 
"DEVELOPER", or "SUPER USER" is usually located, but only the user password is disclosed 
to limit the access the user has. 

In response to the arguments that Smith is unlike the present '899 Application's claimed 
"user table comprising at least a unique user identifier for each authorized user and at least one 
permitted activity said user is authorized to conduct with respect to said data storage media, said 
user identifier, when combined with a user authentication message from said authorized user in 
accordance with a predetermined algorithm, authorizes said user", the arguments have been fully 
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considered but are not deemed persuasive. Smith teaches "parsing the system sign-on by the 
system user and extracting therefrom the unique user identification symbol." This "unique user 
identification symbol" can be read on "user authentication message from said authorized user" 
since the symbol was originally, at the time the user signs onto the system, obtained from the 
user. After this "user identification symbol" is obtained, Smith teaches building the user access 
profile table and the terminal location security access table by "comparing the extracted unique 
user identification symbol against a value based security database having for each unique user 
identification symbol, a first entry representing the unique user identification symbol and a 
second entry containing a selected set of access rules associated with the first entry". The 
"comparing" is a simple algorithm used to find where the user is authorized to access (authorizes 
the user). It is inherent that the tables that are being built in Smith are being built from a table in 
the "value based security database". 

In response to the arguments that "Smith does not add portability of a security system to 
Anderl et al the arguments have been fully considered but are not deemed persuasive. Smith is 
not relied upon to teach portability of a security system. One cannot show nonobviousness by 
attacking references individually where the rejections are based on combinations of references. 
See In re Keller, 642 F.2d 413, 208 USPQ 871 (CCPA 1981); In re Merck & Co., 800 F.2d 1091, 
231 USPQ 375 (Fed. Cir. 1986), 

In response to the applicant's arguments that "Bapat et al. teaches away from ... a 
'portable security system *** wherein said computer processor user table comprises a separate 
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entry for each said user identifier and said permitted activity said user is authorized to conduct'", 
the arguments have been folly considered but are not deemed persuasive because the remarks 
made supporting this argument do not seem to correspond to the argument given. 

In response to the applicant's arguments that "Bapat et al. teaches away from . . . 
combining said user authentication message with said class identifier. the arguments have 
been folly considered but are not deemed persuasive because the remarks supporting this 
argument do not seem to correspond to the argument given. 

In the interests of furthering prosecution of this case the examiner notes that the 
disclosure of Anderl et al. as modified by Smith appears to be related to the invention that the 
applicant is currently claiming, but does not seem similar to the invention disclosed by the 
applicant. As seen in the current application's figure 1 and the description thereof, the wireless 
interface is used to authorize the user, but the data the user is trying to gain access to is not kept 
on the authorization device. The data is stored on a device such as a magnetic tape cartridge or 
an optical disk on which is attached the wireless authorization device. If limitations where made 
in the independent claims in this manner, the claims would become patentably distinct over the 
cited references since Anderl et al. only allows small amounts of data to be stored (i.e. credit card 
data, bank data, and medical data for one person) whereas the applicant's disclosed (but 
unclaimed) invention allows large amounts of data to be stored via the tape or optical drive. 
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Conclusion 



6. 



Any inquiry concerning this communication or earlier communications from the 



examiner should be directed to Jacob F. Betit whose telephone number is (571) 272-4075. The 
examiner can normally be reached on Monday through Friday 9 am to 5 pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Charles Rones can be reached on (571) 272-4085. The fax phone number for the 
organization where this application or proceeding is assigned is 703-872-9306. 
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